https://github.com/python/cpython/commit/1729d99f09f54e4ef298c2d15e9fa355d72863ca
commit: 1729d99f09f54e4ef298c2d15e9fa355d72863ca
branch: 3.11
author: William Woodruff <[email protected]>
committer: hugovk <[email protected]>
date: 2026-04-02T08:51:04+03:00
summary:
[3.11] gh-146488: hash-pin all action references (gh-146489) (#147979)
files:
M .github/workflows/build.yml
M .github/workflows/build_msi.yml
M .github/workflows/documentation-links.yml
M .github/workflows/lint.yml
M .github/workflows/new-bugs-announce-notifier.yml
M .github/workflows/require-pr-label.yml
M .github/workflows/reusable-docs.yml
M .github/workflows/reusable-macos.yml
M .github/workflows/reusable-ubuntu.yml
M .github/workflows/reusable-windows.yml
M .github/workflows/stale.yml
M .github/workflows/verify-ensurepip-wheels.yml
M .github/workflows/verify-expat.yml
diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 9615c513dd67da..87091022c29303 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -32,7 +32,7 @@ jobs:
run_ssl_tests: ${{ steps.check.outputs.run_ssl_tests }}
config_hash: ${{ steps.config_hash.outputs.hash }}
steps:
- - uses: actions/checkout@v6
+ - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd #
v6.0.2
- name: Check for source changes
id: check
run: |
@@ -64,7 +64,7 @@ jobs:
- name: Get a list of the changed documentation-related files
if: github.event_name == 'pull_request'
id: changed-docs-files
- uses: Ana06/[email protected]
+ uses: Ana06/get-changed-files@25f79e676e7ea1868813e21465014798211fad8c
# v2.3.0
with:
filter: |
Doc/**
@@ -91,10 +91,10 @@ jobs:
needs: check_source
if: needs.check_source.outputs.run_tests == 'true'
steps:
- - uses: actions/checkout@v6
+ - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd #
v6.0.2
with:
persist-credentials: false
- - uses: actions/setup-python@v6
+ - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 #
v6.2.0
- name: Install dependencies
run: |
sudo ./.github/workflows/posix-deps-apt.sh
@@ -123,7 +123,7 @@ jobs:
if: ${{ failure() && steps.check.conclusion == 'failure' }}
run: |
make regen-abidump
- - uses: actions/upload-artifact@v6
+ - uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f
# v6.0.0
name: Publish updated ABI files
if: ${{ failure() && steps.check.conclusion == 'failure' }}
with:
@@ -139,16 +139,16 @@ jobs:
needs: check_source
if: needs.check_source.outputs.run_tests == 'true'
steps:
- - uses: actions/checkout@v6
+ - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd #
v6.0.2
with:
persist-credentials: false
- - uses: actions/setup-python@v6
+ - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 #
v6.2.0
with:
python-version: '3.x'
- name: Runner image version
run: echo "IMAGE_OS_VERSION=${ImageOS}-${ImageVersion}" >>
"$GITHUB_ENV"
- name: Restore config.cache
- uses: actions/cache@v5
+ uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5.0.4
with:
path: config.cache
# Include env.pythonLocation in key to avoid changes in environment
when setup-python updates Python
@@ -158,7 +158,7 @@ jobs:
- name: Add ccache to PATH
run: echo "PATH=/usr/lib/ccache:$PATH" >> "$GITHUB_ENV"
- name: Configure ccache action
- uses: hendrikmuhs/[email protected]
+ uses:
hendrikmuhs/ccache-action@5ebbd400eff9e74630f759d94ddd7b6c26299639 # v1.2.20
with:
save: false
- name: Check Autoconf version 2.69 and aclocal 1.16.3
@@ -243,13 +243,13 @@ jobs:
OPENSSL_DIR: ${{ github.workspace }}/multissl/openssl/${{
matrix.openssl_ver }}
LD_LIBRARY_PATH: ${{ github.workspace }}/multissl/openssl/${{
matrix.openssl_ver }}/lib
steps:
- - uses: actions/checkout@v6
+ - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
with:
persist-credentials: false
- name: Runner image version
run: echo "IMAGE_OS_VERSION=${ImageOS}-${ImageVersion}" >> "$GITHUB_ENV"
- name: Restore config.cache
- uses: actions/cache@v5
+ uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5.0.4
with:
path: config.cache
key: ${{ github.job }}-${{ env.IMAGE_OS_VERSION }}-${{
needs.check_source.outputs.config_hash }}
@@ -264,7 +264,7 @@ jobs:
echo
"LD_LIBRARY_PATH=${GITHUB_WORKSPACE}/multissl/openssl/${OPENSSL_VER}/lib" >>
"$GITHUB_ENV"
- name: 'Restore OpenSSL build'
id: cache-openssl
- uses: actions/cache@v5
+ uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5.0.4
with:
path: ./multissl/openssl/${{ env.OPENSSL_VER }}
key: ${{ matrix.os }}-multissl-openssl-${{ env.OPENSSL_VER }}
@@ -275,7 +275,7 @@ jobs:
run: |
echo "PATH=/usr/lib/ccache:$PATH" >> "$GITHUB_ENV"
- name: Configure ccache action
- uses: hendrikmuhs/[email protected]
+ uses: hendrikmuhs/ccache-action@5ebbd400eff9e74630f759d94ddd7b6c26299639
# v1.2.20
with:
save: false
- name: Configure CPython
@@ -298,13 +298,13 @@ jobs:
PYTHONSTRICTEXTENSIONBUILD: 1
ASAN_OPTIONS: detect_leaks=0:allocator_may_return_null=1:handle_segv=0
steps:
- - uses: actions/checkout@v6
+ - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
with:
persist-credentials: false
- name: Runner image version
run: echo "IMAGE_OS_VERSION=${ImageOS}-${ImageVersion}" >> "$GITHUB_ENV"
- name: Restore config.cache
- uses: actions/cache@v5
+ uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5.0.4
with:
path: config.cache
key: ${{ github.job }}-${{ env.IMAGE_OS_VERSION }}-${{
needs.check_source.outputs.config_hash }}
@@ -313,7 +313,7 @@ jobs:
- name: Install dependencies
run: sudo ./.github/workflows/posix-deps-apt.sh
- name: Set up GCC-10 for ASAN
- uses: egor-tensin/setup-gcc@v2
+ uses: egor-tensin/setup-gcc@a2861a8b8538f49cf2850980acccf6b05a1b2ae4 #
v2.0
with:
version: 10
- name: Configure OpenSSL env vars
@@ -323,7 +323,7 @@ jobs:
echo
"LD_LIBRARY_PATH=${GITHUB_WORKSPACE}/multissl/openssl/${OPENSSL_VER}/lib" >>
"$GITHUB_ENV"
- name: 'Restore OpenSSL build'
id: cache-openssl
- uses: actions/cache@v5
+ uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5.0.4
with:
path: ./multissl/openssl/${{ env.OPENSSL_VER }}
key: ${{ matrix.os }}-multissl-openssl-${{ env.OPENSSL_VER }}
@@ -334,7 +334,7 @@ jobs:
run: |
echo "PATH=/usr/lib/ccache:$PATH" >> "$GITHUB_ENV"
- name: Configure ccache action
- uses: hendrikmuhs/[email protected]
+ uses: hendrikmuhs/ccache-action@5ebbd400eff9e74630f759d94ddd7b6c26299639
# v1.2.20
with:
save: ${{ github.event_name == 'push' }}
max-size: "200M"
diff --git a/.github/workflows/build_msi.yml b/.github/workflows/build_msi.yml
index 505c3858348af8..73190e4379b233 100644
--- a/.github/workflows/build_msi.yml
+++ b/.github/workflows/build_msi.yml
@@ -36,7 +36,7 @@ jobs:
runs-on: windows-2022
timeout-minutes: 60
steps:
- - uses: actions/checkout@v6
+ - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
- name: Build CPython installer
run: .\Tools\msi\build.bat -x86
@@ -45,7 +45,7 @@ jobs:
runs-on: windows-2022
timeout-minutes: 60
steps:
- - uses: actions/checkout@v6
+ - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
- name: Build CPython installer
run: .\Tools\msi\build.bat -x64
@@ -54,6 +54,6 @@ jobs:
runs-on: windows-2022
timeout-minutes: 60
steps:
- - uses: actions/checkout@v6
+ - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
- name: Build CPython installer
run: .\Tools\msi\build.bat -arm64
diff --git a/.github/workflows/documentation-links.yml
b/.github/workflows/documentation-links.yml
index 43a7afec73884e..e35c0182ff4024 100644
--- a/.github/workflows/documentation-links.yml
+++ b/.github/workflows/documentation-links.yml
@@ -21,7 +21,7 @@ jobs:
documentation-links:
runs-on: ubuntu-latest
steps:
- - uses: readthedocs/actions/preview@v1
+ - uses:
readthedocs/actions/preview@b8bba1484329bda1a3abe986df7ebc80a8950333 # v1.5
with:
project-slug: "cpython-previews"
single-version: "true"
diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml
index 9fc8b37e440b9e..20d1477e508468 100644
--- a/.github/workflows/lint.yml
+++ b/.github/workflows/lint.yml
@@ -19,8 +19,8 @@ jobs:
timeout-minutes: 10
steps:
- - uses: actions/checkout@v6
- - uses: actions/setup-python@v6
+ - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd #
v6.0.2
+ - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 #
v6.2.0
with:
python-version: "3.x"
- - uses: pre-commit/[email protected]
+ - uses: pre-commit/action@2c7b3805fd2a0fd8c1884dcaebf91fc102a13ecd #
v3.0.1
diff --git a/.github/workflows/new-bugs-announce-notifier.yml
b/.github/workflows/new-bugs-announce-notifier.yml
index d9b9db4d52d941..69cf113f8f00d5 100644
--- a/.github/workflows/new-bugs-announce-notifier.yml
+++ b/.github/workflows/new-bugs-announce-notifier.yml
@@ -13,12 +13,12 @@ jobs:
runs-on: ubuntu-latest
timeout-minutes: 10
steps:
- - uses: actions/setup-node@v6
+ - uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f #
v6.3.0
with:
node-version: 14
- run: npm install mailgun.js form-data
- name: Send notification
- uses: actions/github-script@v8
+ uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd #
v8.0.0
env:
MAILGUN_API_KEY: ${{ secrets.PSF_MAILGUN_KEY }}
with:
diff --git a/.github/workflows/require-pr-label.yml
b/.github/workflows/require-pr-label.yml
index ff5cbdf3eda749..5af45789226278 100644
--- a/.github/workflows/require-pr-label.yml
+++ b/.github/workflows/require-pr-label.yml
@@ -16,7 +16,7 @@ jobs:
timeout-minutes: 10
steps:
- - uses: mheap/github-action-required-labels@v5
+ - uses:
mheap/github-action-required-labels@0ac283b4e65c1fb28ce6079dea5546ceca98ccbe #
v5.5.2
with:
mode: exactly
count: 0
diff --git a/.github/workflows/reusable-docs.yml
b/.github/workflows/reusable-docs.yml
index c9372d09124d29..e99cc1fa5f217d 100644
--- a/.github/workflows/reusable-docs.yml
+++ b/.github/workflows/reusable-docs.yml
@@ -17,9 +17,9 @@ jobs:
runs-on: ubuntu-latest
timeout-minutes: 60
steps:
- - uses: actions/checkout@v6
+ - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
- name: 'Set up Python'
- uses: actions/setup-python@v6
+ uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 #
v6.2.0
with:
python-version: '3'
cache: 'pip'
@@ -29,7 +29,7 @@ jobs:
- name: 'Build HTML documentation'
run: make -C Doc/ SPHINXOPTS="-q" SPHINXERRORHANDLING="-W --keep-going"
html
- name: 'Upload'
- uses: actions/upload-artifact@v6
+ uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f #
v6.0.0
with:
name: doc-html
path: Doc/build/html
@@ -40,9 +40,9 @@ jobs:
runs-on: ubuntu-latest
timeout-minutes: 60
steps:
- - uses: actions/checkout@v6
+ - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
- name: 'Set up Python'
- uses: actions/setup-python@v6
+ uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 #
v6.2.0
with:
python-version: '3.11' # known to work with Sphinx 4.2
cache: 'pip'
@@ -58,8 +58,8 @@ jobs:
runs-on: ubuntu-latest
timeout-minutes: 60
steps:
- - uses: actions/checkout@v6
- - uses: actions/cache@v5
+ - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+ - uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5.0.4
with:
path: ~/.cache/pip
key: ubuntu-doc-${{ hashFiles('Doc/requirements.txt') }}
diff --git a/.github/workflows/reusable-macos.yml
b/.github/workflows/reusable-macos.yml
index aa0f4f3a332ee9..c4cbe180430f16 100644
--- a/.github/workflows/reusable-macos.yml
+++ b/.github/workflows/reusable-macos.yml
@@ -28,11 +28,11 @@ jobs:
]
runs-on: ${{ matrix.os }}
steps:
- - uses: actions/checkout@v6
+ - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
- name: Runner image version
run: echo "IMAGE_OS_VERSION=${ImageOS}-${ImageVersion}" >> "$GITHUB_ENV"
- name: Restore config.cache
- uses: actions/cache@v5
+ uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5.0.4
with:
path: config.cache
key: ${{ github.job }}-${{ env.IMAGE_OS_VERSION }}-${{
inputs.config_hash }}
diff --git a/.github/workflows/reusable-ubuntu.yml
b/.github/workflows/reusable-ubuntu.yml
index 9ec9888269e645..bc62521b6b914b 100644
--- a/.github/workflows/reusable-ubuntu.yml
+++ b/.github/workflows/reusable-ubuntu.yml
@@ -24,7 +24,7 @@ jobs:
OPENSSL_VER: 3.0.15
PYTHONSTRICTEXTENSIONBUILD: 1
steps:
- - uses: actions/checkout@v6
+ - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
with:
persist-credentials: false
- name: Register gcc problem matcher
@@ -38,7 +38,7 @@ jobs:
echo
"LD_LIBRARY_PATH=${GITHUB_WORKSPACE}/multissl/openssl/${OPENSSL_VER}/lib" >>
"$GITHUB_ENV"
- name: 'Restore OpenSSL build'
id: cache-openssl
- uses: actions/cache@v5
+ uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5.0.4
with:
path: ./multissl/openssl/${{ env.OPENSSL_VER }}
key: ${{ matrix.os }}-multissl-openssl-${{ env.OPENSSL_VER }}
@@ -49,7 +49,7 @@ jobs:
run: |
echo "PATH=/usr/lib/ccache:$PATH" >> "$GITHUB_ENV"
- name: Configure ccache action
- uses: hendrikmuhs/[email protected]
+ uses: hendrikmuhs/ccache-action@5ebbd400eff9e74630f759d94ddd7b6c26299639
# v1.2.20
with:
save: ${{ github.event_name == 'push' }}
max-size: "200M"
@@ -64,7 +64,7 @@ jobs:
- name: Runner image version
run: echo "IMAGE_OS_VERSION=${ImageOS}-${ImageVersion}" >> "$GITHUB_ENV"
- name: Restore config.cache
- uses: actions/cache@v5
+ uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5.0.4
with:
path: ${{ env.CPYTHON_BUILDDIR }}/config.cache
key: ${{ github.job }}-${{ env.IMAGE_OS_VERSION }}-${{
inputs.config_hash }}
diff --git a/.github/workflows/reusable-windows.yml
b/.github/workflows/reusable-windows.yml
index 92ff7219f97805..851f501dbf42c4 100644
--- a/.github/workflows/reusable-windows.yml
+++ b/.github/workflows/reusable-windows.yml
@@ -14,7 +14,7 @@ jobs:
env:
IncludeUwp: 'true'
steps:
- - uses: actions/checkout@v6
+ - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
- name: Build CPython
run: .\PCbuild\build.bat -e -d -p Win32 ${{ inputs.free-threading &&
'--disable-gil' || '' }}
- name: Display build info
@@ -29,7 +29,7 @@ jobs:
env:
IncludeUwp: 'true'
steps:
- - uses: actions/checkout@v6
+ - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
- name: Register MSVC problem matcher
run: echo "::add-matcher::.github/problem-matchers/msvc.json"
- name: Build CPython
@@ -46,7 +46,7 @@ jobs:
env:
IncludeUwp: 'true'
steps:
- - uses: actions/checkout@v6
+ - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
- name: Register MSVC problem matcher
run: echo "::add-matcher::.github/problem-matchers/msvc.json"
- name: Build CPython
diff --git a/.github/workflows/stale.yml b/.github/workflows/stale.yml
index 07608fe91b4dbe..23a316befc6cba 100644
--- a/.github/workflows/stale.yml
+++ b/.github/workflows/stale.yml
@@ -16,7 +16,7 @@ jobs:
steps:
- name: "Check PRs"
- uses: actions/stale@v9
+ uses: actions/stale@5bef64f19d7facfb25b37b414482c7164d639639 # v9.1.0
with:
repo-token: ${{ secrets.GITHUB_TOKEN }}
stale-pr-message: 'This PR is stale because it has been open for 30
days with no activity.'
diff --git a/.github/workflows/verify-ensurepip-wheels.yml
b/.github/workflows/verify-ensurepip-wheels.yml
index 00bcf3370e0865..2c47fdbc1e12b5 100644
--- a/.github/workflows/verify-ensurepip-wheels.yml
+++ b/.github/workflows/verify-ensurepip-wheels.yml
@@ -25,8 +25,8 @@ jobs:
runs-on: ubuntu-latest
timeout-minutes: 10
steps:
- - uses: actions/checkout@v6
- - uses: actions/setup-python@v6
+ - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd #
v6.0.2
+ - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 #
v6.2.0
with:
python-version: '3'
- name: Compare checksums of bundled pip and setuptools to ones
published on PyPI
diff --git a/.github/workflows/verify-expat.yml
b/.github/workflows/verify-expat.yml
index 6b12b95cb11ff2..472a11db2da5fb 100644
--- a/.github/workflows/verify-expat.yml
+++ b/.github/workflows/verify-expat.yml
@@ -23,7 +23,7 @@ jobs:
runs-on: ubuntu-latest
timeout-minutes: 5
steps:
- - uses: actions/checkout@v6
+ - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd #
v6.0.2
with:
persist-credentials: false
- name: Download and verify bundled libexpat files
_______________________________________________
Python-checkins mailing list -- [email protected]
To unsubscribe send an email to [email protected]
https://mail.python.org/mailman3//lists/python-checkins.python.org
Member address: [email protected]
